CVE-2019-7942

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates...

CVE-2019-7942

Magento 2.x vulnerability CVE-2019-7942 affects Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7940

CVE-2019-7940 is a stored cross-site scripting vulnerability in Magento products affecting multiple lines: Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue arises when an au...

CVE-2019-7940

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7939

Summary: CVE-2019-7939 is a reflected cross-site scripting vulnerability on Magento’s customer cart checkout page affecting Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7939

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...

CVE-2019-7938

CVE-2019-7938 is a stored cross-site scripting vulnerability in Magento products. The issue affects Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Magento 2.x releases (2.1 up to 2.1.18, 2.2 up to 2.2.9, 2.3 up to 2.3.2). Affected scenario: an authenticated user wit...

CVE-2019-7938

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7937

Magento 2.x stored XSS vulnerability (CVE-2019-7937) exists in admin panel. Affected: Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. Exploitation requires an authenticated user with privileges to store product attributes to inject JavaScript. Remediation: apply patch upd...

CVE-2019-7937

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript...

CVE-2019-7936

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript...

CVE-2019-7936

Summary: CVE-2019-7936 is a stored cross-site scripting (XSS) vulnerability in Magento Open Source/Commerce admin panel. Affected versions (per sources): Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. The issue arises from insufficient validation allowing an au...

CVE-2019-7935

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7935

Magento CVE-2019-7935 describes a stored cross-site scripting vulnerability in the admin panel reachable by authenticated users with content-page-title privileges. Affected are Magento Open Source < 1.9.4.2 and Magento Commerce < 1.14.4.2, Magento 2.1 < 2.1.18, Magento 2.2 < 2.2.9, an...

CVE-2019-7934

CVE-2019-7934 is a stored XSS vulnerability in Magento products. An authenticated user with privileges to edit newsletter templates could inject malicious JavaScript via the admin panel. Affected versions include Magento Open Source before 1.9.4.2, Magento Commerce before 1.14.4.2, Magento 2.1 be...

CVE-2019-7934

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7932

CVE-2019-7932 describes a remote code execution in Magento Open Source <1.9.4.2, Magento Commerce <1.14.4.2, Magento 2.1 <2.1.18, 2.2 <2.2.9, or 2.3

CVE-2019-7932

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary P...

CVE-2019-7930

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

CVE-2019-7930

Magento 2.x suffers a file upload restriction bypass (CVE-2019-7930). An authenticated admin with access to the import feature can modify a configuration file, removing upload restrictions and enabling arbitrary code execution when a malicious file is uploaded. Affected versions: Magento 2.1 <...